See section "1.1.2.10 String Contention" of the applicant guidebook. In the guidebook it ultimately may come down to "community resolution" or auctioning.
I want to know how a doughnut company could get .world
It's not a doughnut company, it's a VC-founded internet startup!
And even if it were a doughnut company they'd still have every right to apply for it. No one has gotten anything yet. :-)
donuts.co is a domain registrar (and/or holding company). They're probably a broker for a large number of other companies, because various other @donut.co email addresses for a multitude of other custom TLDs are present on this list, with the email address username generally matching up to a slugified version of the applicant name.